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(54) One-way roaming from ANS-41 to GSM systems 



(57) Disclosed is a method and apparatus for pro- 
viding authentication for a subscriber of a wireless com- 
munication system employing one type of authentica- 
tion technology roaming into a wireless communication 
system employing a second type of authentication tech- 
nology. The method and apparatus involves transmitting 
(or receiving) a first message to a first system compris- 
ing a mobile identifier for a subscriber of the first and a 
second system indicator indicating that the subscriber 



is attempting to gain access to a second system that 
uses an authentication process different than an au- 
thentication process used by the first system; determin- 
ing shared secret data for the subscriber using the mo- 
bile identifier; receiving (or transmitting) a second mes- 
sage from the first system having shared secret data as- 
sociated with the subscriber; generating an expected re- 
sponse to a unique challenge using the shared secret 
data and an encryption algorithm, and transmitting the 
expected response to the second system. 
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Description 

FIELD OF THE INVENTION 

[0001] The present invention relates generally to wire- 
less communication systems and, in particular, to roam- 
ing among wireless communication systems. 

BACKGROUND OF THE RELATED ART 

[0002] Subscribers to wireless communication sys- 
tems employing the well-known ANS-41 signaling pro- 
tocol standard may, at times, roam outside their home 
system and into wireless communication systems em- 
ploying the well known GSM standard. Assuming that 
the subscribers have user equipment or mobile-stations 
operable to function in either wireless communication 
system, some form of authentication needs to be per- 
formed before the GSM based wireless communica- 
tions system can provide any type of service to the sub- 
scribers of the ANS-41 based wireless communication 
systems. However, the manner in which authentication 
is performed in GSM and ANS-41 based wireless com- 
munication systems are different. Accordingly, there ex- 
ists a need for providing authentication for a subscriber 
to a ANS-41 based wireless communication system 
roaming into a GSM based wireless communication sys- 
tem, and vice-versa. 

SUMMARY OF THE INVENTION 

[0003] The present invention is a method and appa- 
ratus for providing authentication for a subscriber of a 
wireless communication system employing one type of 
authentication technology roaming into a wireless com- 
munication system employing a second type of authen- 
tication technology. The present invention involves 
transmitting (or receiving) a first message to a first sys- 
tem comprising a mobile identifier for a subscriber of the 
first and a second system indicator indicating that the 
subscriber is attempting to gain access to a second sys- 
tem that uses an authentication process different than 
an authentication process used by the first system; de- 
termining shared secret data for the subscriber using the 
mobile identifier; receiving (or transmitting) a second 
message from the first system having shared secret da- 
ta associated with the subscriber; generating an expect- 
ed response to a unique challenge using the shared se- 
cret data and an encryption algorithm, and transmitting 
the expected response to the second system. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0004] The features, aspects, and advantages of the 
present invention will become better understood with re- 
gard to the following description, appended claims, and 
accompanying drawings where: 



FIG. 1 depicts an example of an IIF of the present 
invention positioned between the edges of a GSM 
system and an ANS-41 system; 
FIG. 2 depicts an example of a successful authen- 

5 tication of a subscriber of ANS-41 system in GSM 
system in an initial access attempt; 
FIG. 3 depicts an example of an unsuccessful au- 
thentication of a subscriber of ANS-41 system in 
GSM system in an initial access attempt; and 

10 FIG. 4 depicts an example of a successful authen- 
tication of a subscriber of ANS-41 system in GSM 
system in an initial access attempt in which a Reg- 
istration Notification INVOKE with a SYSACCTYPE 
parameter value indicating GSM access with suc- 

15 cessful authentication is used. 

DETAILED DESCRIPTION 

[0005] The present invention uses an Interoperability/ 
20 Interworking Funcition (IIF) as a logical network entity 
between the edges of two wireless communication sys- 
tems based on different technologies to map or convert 
operations, messages and/or procedures from one sig- 
naling protocol to another (e.g., ANS-41 to GSM). For 
25 purposes of discussion, the present invention will be de- 
scribed herein with reference to a subscriber of an ANS- 
41 based wireless communication system (ANS-41) 
roaming or visiting in a GSM based wireless communi- 
cation (GSM system). It should be understood that the 
30 present invention can also be applied for a subscriber 
of a GSM based wireless communication system roam- 
ing or visiting in an ANS-41 based wireless communi- 
cation system. 

[0006] FIG. 1 depicts an example of an IIF 10 of the 

35 present invention positioned between the edges of a 
GSM system 12 and an ANS-41 system 14, wherein 
ANS-41 system 14 includes enhanced authentication 
and mobility management capabilities to support roam- 
ing of its subscribers to GSM system 12, as will be de- 

40 scribed herein. 

[0007] A subscriber of ANS-41 system 14 is equipped 
with user equipment 16. User equipment 16 is either an 
ANS-41 based user equipment capable of roaming into 
GSM system 1 2 or a GSM based user equipment having 

45 a User Identity Module (UIM) of the subscriber. Regard- 
less of the type of user equipment 16, a Mobile-station 
Identification Number (MIN) based on an International 
Mobile-station Subscriber Identification (IMSI) is pro- 
grammed in user equipment 16 for use in GSM system 

so 12. User equipment 16 (or the UIM inserted therein) is 
capable of generating Shared Secret Data (SSD) for the 
subscriber, and to use the SSD and the well-known 
CAVE algorithm (or some other encryption algorithm) to 
generate a response (RES) to random challenges 

55 (RAND) issued by GSM system 12 and to generate a 
cipher key K^ 

[0008] Preferably, IIF 1 0 requires no or little changes 
to standard network protocol in its interactions with ei- 
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ther systems 12 or 14. IIF 1 0 functions as a Visitor Lo- 
cation Register (VLR) in its interactions with ANS-41 
system 1 4 to support roaming of the subscriber in GSM 
system 12. IIF 10 functions as a GSM Home Location 
Register (HLR) and Authentication Center (AC) in its in- 
teractions with GSM system 12. IIF 1 0 supports the en- 
hanced operations required for authentication of user 
equipment 16 in GSM system 12. IIF 10 provides GSM 
triplets needed for authentication and privacy in GSM 
system 12 using the CAVE algorithm and the SSD pro- 
vided by an HLR of the wireless communication system 
to which user equipment 1 6 belongs, wherein the GSM 
triplets include the RAND, and an expected response 
(XRES). IIF 10 is operable to convert an IMSI into a MIN 
to be used by ANS-41 system 14, and a MIN into an 
IMSI to be used by GSM system 12. 
[0009] ANS-41 system 1 4 shares SSD with IIF 1 0 for 
roaming subscribers of ANS-41 system 14 into GSM 
system 12. Note that the AC should not be able to up- 
date SSD or a COUNT value for the subscriber when 
the subscriber is being served by GSM system 1 2. The 
subscriber's SSD is updated when the user returns to 
ANS-41 system 12 or leaves GSM system 14. IIF 10 is 
capable of providing a secure method of storing SSD 
received from ANS-41 system 1 4. IIF 1 0 does not trans- 
mit or otherwise disclose the SSD to any other network 
entity. 

[0010] For illustration purposes, the following exam- 
ple of a subscriber of ANS-41 system 1 4 roaming or vis- 
iting GSM system 12 is provided. User equipment 16 
presents itself to GSM system 12 for service. GSM sys- 
tem 1 2 records the presence of user equipment 1 6 in its 
VLR and will attempt to authenticate user equipment 1 6 
via the HLR of ANS-41 system 14. Since the VLR of 
GSM system 12 and the HLR of ANS-41 system are of 
different technologies, IIF 10 is needed to assist in the 
authentication process, including translating messages 
between the two systems 12 and 14. 
[0011] In IIF 10's interactions with GSM system 12, 
IIF 10 appears to GSM system 12 as a HLR of the same 
technology as GSM system 12. By contrast, in IIF 10's 
interactions with ANS-41 system 14, IIF 10 appears to 
ANS-41 system 1 4 as a VLR of the same technology as 
ANS-41 system 14. When IIF 10 receives a message 
from GSM system 12 for authentication of user equip- 
ment 16, IIF converts the message to a format based 
on ANS-41 . The converted message is then transmitted 
to ANS-41 system 14. 

[0012] Preferably, IIF does not need to be provisioned 
with any subscriber specific data, such as Mobile-Sta- 
tion Identification (MSID) in the form of a MIN or IMSI. 
Subscriber specific data can also include an Electronic 
Serial Number (ESN) of the subscriber associated with 
the MIN. A common identifier is preferably used by GSM 
system 12 and ANS-41 system 14 for user equipment 
16. For example, the IMSI is used in both systems 12 
and 14 to identify user equipment 16. However, when 
different identifiers are used by both systems 12 and 14 



to identify a subscriber, IIF 10 needs to convert identifi- 
ers used in one system to identifiers used in the other 
system. In this situation, either a database forconverting 
identifiers (e.g., from IMSI to MIN, and vice-versa) would 

5 be required or a change to the receiving system may be 
required. For example, the ESN is required to authenti- 
cate a subscriber of ANS-41 system 14 but not in GSM 
system 12. When user equipment 16 of the subscriber 
presents itself to GSM system 12, GSM system 12 does 

10 not require the ESN of user equipment 1 6. Thus, GSM 
system 12 does not present to IIF 10 the ESN since it 
thinks its interacting with a GSM based VLR. When IIF 
1 0 attempts to use the information provided to it by GSM 
system 1 2 to authenticate user equipment 1 6 with ANS- 

15 41 system 14, IIF 10 does not have an ESN to provide 
the HLR of ANS-41 system 14 as required in an ANS- 
41 authentication request operation (AUTHREQ). To 
compensate for this lack of ESN and appear to ANS-41 
system 14 as a ANS-41 based VLR, the present inven- 

20 tion requires IIF 1 0 to present a default or mull value in 
place of an ESN in the AUTHREQ. In response to the 
AUTHREQ, the HLR of ANS-41 system 14 responds 
with the subscriber's real ESN. IIF 10 stores the sub- 
scriber's real ESN in its temporary memory to present 

25 to ANS-41 system 14 in future operations where it is re- 
quired. The subscriber's real ESN is preferably not 
saved by IIF 1 0 after the subscriber leaves GSM system 
12. 

[0013] The above described exchange of ESN (be- 
so tween IIF 1 0 and ANS-41 system 14) is not normally ac- 
ceptable to the HLR of ANS-41 system 14. Inthe present 
invention, an exception for exchanging the ESN is al- 
lowed at the HLR of ANS-41 system 14. That is, for sub- 
scribers of ANS-41 system 14 roaming into GSM system 
35 12, the HLR of ANS-41 system 14 will permit an ex- 
change of ESN with IIF 1 0. IIF 10 will provide an indica- 
tion to ANS-41 system 1 4 that the subscriber is roaming 
in GSM system 12. For example, the indication is a 
unique value in a system capability (SYSCAP) param- 
40 eter. A GSM system access type may also be indicated 
through a unique value in a System Access Type 
(SYSACCTYPE) parameter. 

[0014] SSD is typically provided by ANS-41 system 
14 to the system currently serving its subscriber (i.e., 

45 GSM system 12) to authenticate the subscriber. The 
SSD provided by the home ANS-41 system is used to 
produce authentication vectors usable by the VLR of 
GSM system 12 to authenticate the subscriber. 
[0015] FIG. 2 depicts an example 20 of a successful 

so authentication of a subscriber of ANS-41 system 14 in 
GSM system 12 in an initial access attempt, wherein us- 
er equipment 16 associated with the subscriber uses a 
MIN-based IMSI as its identifier in GSM system 12. In 
step a, the mobile-station (MS) or user equipment de- 

55 termines that a new serving system, i.e., GSM system 
12 has been entered. MS registers at GSM system 12 
and requests for system access by providing its MIN- 
based IMSI to GSM system 1 2 in a location area update 
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message. 

[0016] In step b, GSM system 12 sends a 
S END_AUTH ENTI C ATI O NJ N FO to I IF 1 0, wherein the 
SEND_AUTHENTICATION_INFO is an authentication 
information message having the IMSI. In step c, IIF 1 0 5 
sends an AUTHREQ to the HLR of the subscriber's 
home system, i.e., ANS-41 system 14. The AUTHREQ 
includes a MSCID, SYSCAP, MINI, ESN, and SYSACC- 
TYPE, wherein MSCID identifies IIF 10, SYSCAP indi- 
cates that the subscriber is roaming in GSM system 12, 10 
ESN is a defau.lt value and SYSACCTYPE indicates 
GSM system access. The MIN is set to a value derived 
from the MIN-based IMSI. 

[0017] In step d, the HLR forwards the AUTHREQ to 
an authentication center (AC), which may be a part of '5 
ANS-41 system 12 or a separate entity. In step e, the 
AC determines that the subscriber is roaming in GSM 
system 12 based on the SYSCAP and responds with an 
authreq to the HLR, wherein the authreq includes the 
SSD associated with the subscriber. Note that the ESN, 20 
SYSCAP or SYSACCTYPE in the AUTHREQ may 
alone, or in combination, indicate to the HLR or AC that 
the associated subscriber (as indicated by the MIN) is 
attempting to gain access in a system that uses a differ- 
ent authentication process than the AC of the present 25 
system. In step f, the HLR forwards the authreq to IIF 
10. Note that the SYSACCTYPE would indicate to the 
AC that the ESN generated by IIF 10 (i.e., default value) 
is not the real ESN of the subscriber, whereas the SY- 
SCAP indicates that a serving MSC is using GSM au- 30 
thentication and privacy procedures. When the AC sees 
these indications, AC knows its okay to provide the SSD 
of the subscriber. 

[0018] In step g, IGF 10 determines one or more 
groups of GSM triplets using the subscriber's SSD and 35 
the CAVE algorithm. IIF 10 sends a 
SEND_AUTHENTICATIONJNFO acknowledgement 
(or ack) to GSM system 12, wherein the 
SEND_AUTHENTICATIONJNFO ack includes an Au- 
thenticationSetList having the one or more groups of 40 
GSM triplets. 

[0019] In step h, GSM system 12 issues a RAND or 
Unique Challenge to the MS. In step i, the MS responds 
to the RAND with its response or RES. In step j, GSM 
system 1 2 compares the RES received from the MS with 
the expected response or XRES in one of the GSM tri- 
plets. In this example, the RES is identical to the XRES. 
Accordingly, GSM system 12 sends an 
UPDATE_LOCATION to IIF 10, wherein the 
UPDATE_LOCATION includes the IMSI. 50 
[0020] Note that, in one embodiment, TR-46 AHAG is 
used to determine a manner of computing the XRES in 
response to the RAND in GSM system 1 2 by IIF 1 0 and . 
the MS. The TR-45 AHAG may also be used to deter- 
mine how the cipher key is computed. ss 
[0021] In step k, IIF sends an authentication status re- 
port (ASREPORT) to the HLR of ANS-41 system 14, 
wherein the ASREPORT includes the MSCID, MIN and 



a UCHALRPT for indicating that the RAND (or Unique 
Challenge) was successful. In step 1 , the HLR forwards 
the ASREPORT to the AC. In step m, the AC responds 
with an asreporttothe HLR. In step n, the HLR forwards 
the asreport to IIF 10. In step o, IIF 10 sends a registra- 
tion notice (REGNOT) to the HLR, wherein the REG- 
NOT includes the MSCID, SYSCAP, MIN, ESN, 
SYSACCTYPE and a TRANSCAP. The SYSCAP indi- 
cates that the subscriber is roaming in GSM system 12 
and the SYSACCTYPE indicates GSM system access. 
[0022] In step p, the HLR sends a regnot to HF 10, 
which includes a profile of the subscriber. In step q, IIF 
10 sends an INSERT_SUBSCRIBER_DATA to GSM 
system 12. In step r, GSM system 12 responds with an 
INSERT_SUBSCRIBER_DATA ack to IIF 1 0. In step s, 
IIF 10 sends an UPDATEJ-OCATION ack to GSM sys- 
tem 12. In step t, GSM system 12 sends a location area 
update ack to the MS. 

[0023] FIG. 3 depicts an example 30 of an unsuccess- 
ful authentication of a subscriber of ANS-41 system 14 
in GSM system 12 in an initial access attempt, wherein 
user equipment 1 6 associated with the subscriber uses 
a MIN-based IMSI as its identity in GSM system 12. 
Steps a 1 -i l of FIG. 3 corresponding to steps a-i of FIG. 
2. In step j 1t GSM system 12 compares the RES re- 
ceived from the MS with the XRES in one of the GSM 
triplets. In this example, the RES is not identical to the 
XRES. Thus, authentication fails and GSM system 12 
sends an Authentication_Failure to IIF 10, wherein the 
Authentication_Failure indicates the IMSI. 
[0024] In step k 1f IIF 10 sends an ASREPORT to the 
HLR of ANS-41 system 14. The MIN being derived from 
the IMSI and the UCHALRPT indicating the RAND (or 
Unique Challenge) was a failure. In step ^ , the HLR for- 
wards the ASREPORT to the AC. In step the AC 
sends an asreport to the HLR, wherein the asreport in- 
cludes DENACC and NOSSD parameters. In step n 1p 
the HLR forwards the asreport to IIF 10. In step 0 1p IIF 
removes the SSD received for the MS from the AC and 
any other information for the MS from its memory. IIF 1 0 
sends an Authentication_FailureacktoGSM system 12. 
In step p 1f GSM system 12 rejects the MS' request for 
system access. 

[0025] FIG. 4 depicts an example 40 of a successful 
authentication of a subscriber of ANS-41 system 14 in 
GSM system 12 in an initial access attempt, wherein us- 
er equipment 1 6 associated with the subscriber uses a 
MIN-based IMSI as its identity in GSM system 12. In this 
example, IIF 10 would not send an ASREPORT to indi- 
cate a successful Unique Challenge. Rather, IIF 10 
sends a Registration Notification INVOKE with a 
SYSACCTYPE parameter value indicating GSM access 
with successful authentication. 
[0026] Steps a 2 -j 2 of FIG. 4 being identical to steps a- 
j of FIG. 2. In step k 2 , IIF 10 sends a REGNOT to the 
HLR. SYSACCTYPE is set to indicate GSM access with 
successful authentication, and SYSCAP is set to indi- 
cate GSM system 12. In step l 2 , the HLR determines the 
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3. An logical network entity comprising: 

means for transmitting a first message to a first 
system, the first message comprising a mobile 
identifier for a subscriber of the first and a see- 



rs 4. 



25 5. 



subscriber is authorized for service in GSM system 12. 
The HLR sends an ASREPORT to the AC, wherein the 
ASREPORT includes an UCHALRPT indicating that the 
RAND or unique challenge was successful and a 
MSCID set to indicate IIF 10. 5 
[0027] In step m 2 , the AC sends an asreport to the 
HLR. In step n 2 , the HLR sends a regnot to IIF 10. In 
stepo 2l IIF 10 sends an INSERT_SUBSCRIBER_DATA 
to GSM system 12. In step p 2 , GSM system 12 sends 
an INSERT_SUBSCRIBER_DATA ackto IIF 10. In step 10 
q 2 , IIF 10 sends. an UPDATEJ.OCATION ack to GSM 
system 12. In step r 2 , GSM system 12 sends a location 
area update ack to the MS. 

[0028] Although the present invention has been de- 
scribed in considerable detail with reference to certain 
embodiments, other versions are possible. Therefore, 
the spirit and scope of the present invention should not 
be limited to the description of the embodiments con- 
tained herein. 

20 

Claims 

1. A method of providing authentication in a wireless 
communication system comprising the steps of: 

transmitting a first message to a first system, 
the first message comprising a mobile identifier 
for a subscriber of the first and a second system 
indicator indicating that the subscriber is at- 30 
tempting to gain access to a second system 
that uses an authentication process different 
than an authentication process used by the first 
system; 

receiving a second message from the first sys- 35 
tern having shared secret data associated with 
the subscriber; 

generating an expected response to a unique 
challenge using the shared secret data and an 
encryption algorithm; and 40 
transmitting the expected response to the sec- 
ond system. 

2. The method of claim 1 , wherein the second system 
indicator includes at least one of the following: an *5 
electronic serial number set to a default or null val- 
ue; a system capability parameter indicating that 

the subscriber is roaming in a GSM based wireless 
communication system; or a system access type 
parameter indicating that the subscriber is attempt- so 
ing to gain access in a GSM based wireless com- 
munication system. 



ond system indicator indicating that the sub- 
scriber is attempting to gain access to a second 
system that uses an authentication process dif- 
ferent than an authentication process used by 
the first system; 

means for receiving a second message from 
the first system having shared secret data as- 
sociated with the subscriber; 
means for generating an expected response to 
a unique challenge using the shared secret da- 
ta and an encryption algorithm; and 
means for transmitting the expected response 
to the second system. 

The logical network entity of claim 3, wherein the 
second system indicator includes at least one of the 
following: an electronic serial number set to a de- 
fault or null value; a system capability parameter in- 
dicating that the subscriber is roaming in a GSM 
based wireless communication system; or a system 
access type parameter indicating that the subscrib- 
er is attempting to gain access in a GSM based 
wireless communication system. 

A method of providing authentication in a wireless 
communication system comprising the steps of: 

receiving a first message at a first system, the 
first message comprising a mobile identifier for 
a subscriber of the first and a second system 
indicator indicating that the subscriber is at- 
tempting to gain access to a second system 
that uses an authentication process different 
than an authentication process used by the first 
system; 

determining shared secret data associated with 
the subscriber using the mobile identifier and 
the second system indicator; and 
transmitting a second message from the first 
system having the shared secret data. 

The method of claim 5, wherein the second system 
indicator includes at least one of the following: an 
electronic serial number set to a default or null val- 
ue; a system capability parameter indicating that 
the subscriber is roaming in a GSM based wireless 
communication system; or a system access type 
parameter indicating that the subscriber is attempt- 
ing to gain access in a GSM based wireless com- 
munication system. 



55 



7. An authentication system comprising of: 

means for receiving a first message at the au- 
thentication system, the first message compris- 
ing a mobile identifier for a subscriber of a first 
system to which the authentication system is a 
part and a second system indicator indicating 
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that the subscriber is attempting to gain access 
to a second system that uses an authentication 
process different than an authentication proc- 
ess used by the first system; 
means for determining shared secret data as- s 
sociated with the subscriber using the mobile 
identifier and the second system indicator; and 
means for transmitting a second message from 
the first system having the shared secret data. 

w 

8. The authentication center of ciaim 7, wherein the 
second system indicator includes at least one of the 
following: an electronic serial number set to a de- 
fault or null value; a system capability parameter in- 
dicating that the subscriber is roaming in a GSM 15 
based wireless communication system; or a system 
access type parameter indicating that the subscrib- 
er is attempting to gain access in a GSM based 
wireless communication system. 
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FIG. 3 
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